TOMOYO Linux A Lightweight and Manageable Security System for PC - PowerPoint PPT Presentation

CE Linux Forum Worldwide Embedded Linux Conference 2007 April 17-19, 2007 TOMOYO Linux “A Lightweight and Manageable Security System for PC and Embedded Linux” http://tomoyo.sourceforge.jp/ Toshiharu Harada Tetsuo Handa NTT DATA CORPORATION http://www.nttdata.co.jp/en/index.html

Hello, world! Hello, world! • This is the very first presentation abroad for our work, “TOMOYO Linux”. • TOMOYO Linux is a MAC (Mandatory Access Control) implementation for Linux. • TOMOYO Linux consists of a set of patches for kernel 2.4/2.6 and a couple of administrative tools. It has been ported to various distributions. • TOMOYO Linux is available at http://tomoyo.sourceforge.jp/ under the GPL license. • You can browse&search the code at http://tomoyo.sourceforge.jp/cgi-bin/lxr/source 2007-04-18 NTT DATA CORPORATION 2

About NTT DATA About NTT DATA • http://www.nttdata.co.jp/en/index.html • One of the largest SI companies in Japan. – Data • Established: May 23, 1988 • Ordinary Income: 42,016 million yen • Number of Employees: 8,406 • Common Stock: 142,520 million yen • Net Sales: 907,281 million yen • (see http://www.nttdata.co.jp/en/aboutus/a09.html for more detail) • TOMOYO Linux project: – Launched March 2003. – Members: started from 2. currently 5. – Exceptionally small project in the largest company. :-) 2007-04-18 NTT DATA CORPORATION 3

TOMOYO Linux: Background TOMOYO Linux: Background • Originated from NTT DATA CORPORATION R&D. • Project started in March 2003. • First public release in November 2005. • Ported to Debian Sarge/Etch, RedHat Linux 9, Fedora Core 3-6, CentOS 4.4/5, OpenSUSE 10.1/10.2, Asianux 2.0, Ubuntu 6.10/7.04 and more (check the link below). – http://sourceforge.jp/projects/tomoyo/files/ • Suits well to embedded systems. 2007-04-18 NTT DATA CORPORATION 4

Topics Covered in This Session: Topics Covered in This Session: • Overview of TOMOYO Linux and MAC. • What TOMOYO Linux can do/can’t do. • Concepts. • Automatic policy configuring feature. • TOMOYO Linux policy. • How it works. • Short demonstration. • Comparison to other security enhanced OSs. 2007-04-18 NTT DATA CORPORATION 5

Topics NOT Covered in This Session: Topics NOT Covered in This Session: • Whether name-based access control is evil or not. – It’s too technical and complex. – TOMOYO Linux will have a BOF session in the upcoming Ottawa Linux Symposium. Please join and help/save us ! • In-depth demonstration. – Will be shown in the following tutorial session, don’t miss it! Or please consider installing binary package yourself (10 minutes job). • http://tomoyo.sourceforge.jp/en/1.4/install.html 2007-04-18 NTT DATA CORPORATION 6

Part 1 MAC and TOMOYO Linux Overview 2007-04-18 NTT DATA CORPORATION 7

What is “ “MAC MAC” ”? ? What is • “Mandatory Access Control” – No exceptions even for “root” users and no bypass. – Accesses are strictly judged according to the rules (called “policy”). – Traditional access control is referred as DAC (Discretionary Access Control). • Implementation. – (1) “Hook” a request (e.g. system call). – (2) “Judge” whether to execute the request or not. – (3) “Process” the request. – 2.6 kernel has a built-in framework for hooks – LSM (Linux Security Modules). 2007-04-18 NTT DATA CORPORATION 8

What is “ “hook hook” ”? ? What is application system call interface DAC (traditional access control) system call procedures kernel 2007-04-18 NTT DATA CORPORATION 9

What is “ “hook hook” ”? ? What is application system call interface DAC (traditional access control) MAC “policy” hook system call procedures kernel 2007-04-18 NTT DATA CORPORATION 10

What is “ “policy policy” ”? ? What is • DAC checks “rwx” attributes associated with filesystem. (very simple) • MAC engine needs “rules” to make decision. • “Policy” is the name for the rules . – MAC is useless without good policy. • No standard policy syntax exists (so far). • Policy is defined as a set of “conditions”. – if (condition) then Access is (granted/denied). 2007-04-18 NTT DATA CORPORATION 11

What is TOMOYO Linux? What is TOMOYO Linux? • “Lightweight” and “usable” Mandatory Access Control for Linux, with – “automatic policy configuring” feature. – administrators friendly policy language. – English documentation. – 2.4 kernel and BusyBox support. – no filesystem limitations (runs with any filesystem). – no need of libselinux nor userland program modifications. 2007-04-18 NTT DATA CORPORATION 12

What is TOMOYO Linux? What is TOMOYO Linux? • TOMOYO Linux – is not using LSM (Linux Security Modules) . • Some work is in progress. – does not have MLS (Multi Level Security), RBAC (Role Based Access Control) mechanisms.. • If you need MLS, use SELinux. • RBAC like usages are available. – is not included in Linux kernel source. • yet – can do unusual things and playing with TOMOYO Linux is so much fun. – is no guarantee. (use at your own risk, of course) 2007-04-18 NTT DATA CORPORATION 13

What is “ “domain domain” ”? ? What is domain A • Whether a request domain B is legal or not domain C depends on the domain D “context”. • Most MAC system d o m refers this context a i n as “domain”. E /etc/shadow can be read • “Domain” is a kind of group/unit. if … NTT DATA CORPORATION 2007-04-18 NTT DATA CORPORATION 14

TOMOYO Linux Policy TOMOYO Linux Policy • Exceptionally simple. Any Linux/UNIX users can read and write it. <kernel> /usr/sbin/sshd /bin/bash /bin/csh is the current “domain” 1 /bin/grep 1 /bin/sed /bin/csh process 4 /dev/null that was invoked from /bin/bash 4 /etc/csh.cshrc that was invoked from /usr/bin/sshd mode path 4 /etc/group 4 /etc/nsswitch.conf “<kernel>” is the virtual bottom mode: ・・・ 1 --x 1 /usr/bin/[ 2 –w- 1 /usr/bin/dircolors 4 r— 1 /usr/bin/id 6 rw- 1 /usr/bin/test 2007-04-18 NTT DATA CORPORATION 15

SELinux Policy SELinux Policy From Japan Technical Jamboree 12. “*.te”: access control definitions for “*”. “*.fc”: label definitions for “bind”. “fc” stands for “file context”. Policy is described in terms of label, not path name. (but label definition is described in terms of path names). Macros are introduced to make policy more readable. SELinux kernel needs policy to be compiled before use. 2007-04-18 NTT DATA CORPORATION 16

AppArmor Policy AppArmor Policy From Japan Technical Jamboree 12. • Above definition is applied to every instance of /usr/sbin/named (No process invocation history mechanism exists with AppArmor). • In TOMOYO Linux, “<kernel> /foo /bar /usr/sbin/named” and “<kernel> /boo /bar /baz /usr/sbin/named” is distinguished and treated independently. • SELinux simply cares about “label”. 2007-04-18 NTT DATA CORPORATION 17

AppArmor Policy (cont.) AppArmor Policy (cont.) • Similarities with TOMOYO Linux: – Both use “pathname based” definition. • Differences: – TOMOYO Linux distinguishes domain by a process invocation history while AppArmor does by a single process. – TOMOYO Linux provides MAC for network and signals. 2007-04-18 NTT DATA CORPORATION 18

Domains in TOMOYO Linux Domains in TOMOYO Linux • In TOMOYO Linux – every process belongs to a domain. – every process remembers its ancestors. – ACL are controlled by the domain, not by a current process name. • Utility program, “ccstree”, prints out domain information for running processes. 0 +- sshd (2859) <kernel> /usr/sbin/sshd 0 +- sshd (3807) <kernel> /usr/sbin/sshd 1 +- bash (3809) <kernel> /usr/sbin/sshd /bin/bash 2 +- ccstree (3942) <kernel> /usr/sbin/sshd /bin/bash /root/ccstools/ccstree 2007-04-18 NTT DATA CORPORATION 19

TOMOYO Keeps Track of Process TOMOYO Keeps Track of Process Invocation History Invocation History <kernel> /sbin/mingetty /bin/login /bin/bash /bin/ls <kernel> /sbin/mingetty /bin/login /bin/bash <kernel> /sbin/mingetty /bin/login <kernel> /sbin/mingetty 2007-04-18 NTT DATA CORPORATION 20

A Slightly Complicated Example A Slightly Complicated Example Suppose that you are logged-in into a ssh server and execute a man command: <kernel> /usr/sbin/sshd /bin/bash /usr/bin/man /bin/sh = current domain 1 2 3 4 1 /bin/gunzip 2 /dev/null 6 /dev/tty 4 /etc/mtab 1 /usr/bin/bzip2 1 /usr/bin/gtbl 1 /usr/bin/less 1 /usr/bin/nroff 2 /var/cache/man/cat1/pstree.1.bz2 allow_truncate /var/cache/man/cat1/pstree.1.bz2 2007-04-18 NTT DATA CORPORATION 21

Automatic Policy Generation Automatic Policy Generation • How to use: 1. Change “mode (explained later)” of TOMOYO Linux kernel to “policy generation”. 2. Just operate as you want. 3. TOMOYO Linux generates the required access control lists as policy. 4. Check it and modify it. 5. Done • Advantages – Saves time enormously. – The resulting policy is quite “readable”. 2007-04-18 NTT DATA CORPORATION 22

23 NTT DATA CORPORATION Demo Demo 2007-04-18